14946 matches found
PT-2026-76592
Name of the Vulnerable Software and Affected Versions Drupal Diff versions 0.0.0 through 2.0.1 Drupal Diff versions 2.1.0 through 2.1.1 Description An incorrect authorization issue allows forceful browsing. The module does not sufficiently restrict access to non-node entity revision diffs. This...
Diff - Moderately critical - Access bypass - SA-CONTRIB-2026-096
This module enables you to view the differences between revisions on any entity type. The module doesn't sufficiently restrict access to non-node entity revision diffs. This vulnerability is mitigated by the fact that an attacker must have a role with the permission to view the entity...
Quick Tabs - Moderately critical - Access bypass - SA-CONTRIB-2026-099
This module enables you to display content in tabs, where each tab renders a block, a node, a view, or another Quick Tabs instance. The module did not correctly enforce access when rendering node and block tabs. It treated a neutral access result as a grant for node tabs and block plugins, and...
Entity Share Websub - Moderately critical - Server-side request forgery (SSRF) - SA-CONTRIB-2026-097
This module enables you to share content between sites in a hub - subscriber model. Certain inputs were not sufficiently validated, allowing an attacker to achieve server-side request forgery attacks...
Exploit for Improper Input Validation in Drupal
CVE-2018-7600 Drupalgeddon2 — Red Team Project ITSOLERA...
DRUPAL-CONTRIB-2026-094
The Entity Browser module allows you to select entities from entity reference fields using a custom entity browser widget. The module doesn't sufficiently sanitize the the tab titles, resulting in a stored cross-site scripting XSS vulnerability. The vulnerability is mitigated by the fact an...
DRUPAL-CONTRIB-2026-093
This module provides formatters to allow in-place editing in a View or other display full content, teaser.... The module doesn't sufficiently check access when editing entities. A malicious user could craft requests to allow them to modify any field on any entity. This vulnerability is mitigated ...
Drupal Core 11.3.9 Anonymous Blind SQL Injection
A proof of concept exploit for an anonymous blind SQL injection vulnerability in Drupal Core version 11.3.9. The vulnerability affects Drupal Core versions 8.9.0 through 11.3.9 when using PostgreSQL as the database backend and is caused by improper handling of attacker-controlled array keys while...
📄 Drupal Core 11.3.9 Anonymous Blind SQL Injection
A proof of concept exploit for an anonymous blind SQL injection vulnerability in Drupal Core version 11.3.9. The vulnerability affects Drupal Core versions 8.9.0 through 11.3.9 when using PostgreSQL as the database backend and is caused by improper handling of attacker-controlled array keys while...
K000162772: Drupal vulnerability CVE-2026-9082
Security Advisory Description Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Drupal Drupal core allows SQL Injection. This issue affects Drupal core: from 8.9.0 before 10.4.10, from 10.5.0 before 10.5.10, from 10.6.0 before 10.6.9, from 11.0.0...
CLSA-2026-1785380876 TuxCare security update for drupal/core (4 CVEs)
TuxCare rebuilt drupal/core to address 4 CVEs. Fixed in 8.9.20-p2+tuxcare...
CLSA-2026-1784683000 TuxCare security update for drupal/core (3 CVEs)
TuxCare rebuilt drupal/core to address 3 CVEs. Fixed in 9.5.11-p6+tuxcare...
CLSA-2026-1784682869 TuxCare security update for drupal/core (21 CVEs)
TuxCare rebuilt drupal/core to address 21 CVEs. Fixed in 8.9.20-p1+tuxcare...
CLSA-2026-1783645405 TuxCare security update for drupal/core (2 CVEs)
TuxCare rebuilt drupal/core to address 2 CVEs. Fixed in 9.5.11-p4+tuxcare...
CLSA-2026-1776214337 TuxCare security update for drupal/core (11 CVEs)
TuxCare rebuilt drupal/core to address 11 CVEs. Fixed in 9.5.11-p1+tuxcare...
CLSA-2026-1779410881 TuxCare security update for drupal/core (1 CVE)
TuxCare rebuilt drupal/core to address 1 CVE. Fixed in 9.5.11-p3+tuxcare...
CLSA-2026-1778201069 TuxCare security update for drupal/core (1 CVE)
TuxCare rebuilt drupal/core to address 1 CVE. Fixed in 9.5.11-p2+tuxcare...
GHSA-32RQ-JHR7-M3HH vulnerabilities
Vulnerabilities for packages: drupal, nextcloud-server, privatebin...